fix(auth): a new recovery phrase takes the password too

password.setRecoveryKeys took a session and a TOTP code alone, so a phone
signed in with its authenticator beside it could set a phrase of its
holder's own and, through the phrase's reset, a new password, never
knowing the old one. It now takes the old password's SRP proof (from
beginChange, the caller's own) and a TOTP or recovery code, as changing
the password does: one owner proof for both (_proveOwner), forwarded by
members, asked for in the account section's New recovery phrase.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

docs/adr/0017-password-totp-and-keys.md

@@ -176,7 +176,10 @@ released, stays at 1), after the second reading.
 - **Changing while signed in:** the password (`password.beginChange`, `password.change`:
   the old password's SRP proof, a TOTP or recovery code, the same keys rewrapped on the
   device; every other session ends) and the recovery phrase (`password.setRecoveryKeys`:
-  the keys wrapped under a new phrase, for a code). A session alone changes neither.
+  the keys wrapped under a new phrase, with the old password's proof and a code, as a
+  change of password takes). A session alone changes neither, nor a session with the
+  authenticator beside it (a phone signed in): its holder's own phrase would set a new
+  password through `resetPasswordWithPhrase` (found at step 3's review, 20 Oct).
 - **Sessions end in every service:** a change of password ends every other session of
   the account, a reset of the password or the account all of them, on the register and
   on every member, by a notice kept until each confirms (`sessions_ended_notice`, a new